Bump hub reusable-workflow pins to 2.0.518

.github/workflows/merge-bot-pull-request.yml

@@ -19,7 +19,7 @@ jobs:
 
   merge-bot:
     name: Merge bot pull request job
-    uses: ptr727/ProjectTemplate/.github/workflows/merge-bot-task.yml@a33d7d77ffa7f6af52cddce01f7250be282546ed # 2.0.483
+    uses: ptr727/ProjectTemplate/.github/workflows/merge-bot-task.yml@32582848ffb0505e1044e5552b5ed94c32500c57 # 2.0.518
     secrets:
       CODEGEN_APP_CLIENT_ID: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
       CODEGEN_APP_PRIVATE_KEY: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}

.github/workflows/publish-release.yml

@@ -28,7 +28,7 @@ jobs:
   plan:
     name: Plan release job
     needs: [assert-dispatch-ref]
-    uses: ptr727/ProjectTemplate/.github/workflows/publish-plan-task.yml@a33d7d77ffa7f6af52cddce01f7250be282546ed # 2.0.483
+    uses: ptr727/ProjectTemplate/.github/workflows/publish-plan-task.yml@32582848ffb0505e1044e5552b5ed94c32500c57 # 2.0.518
     with:
       event_name: ${{ github.event_name }}
       actor: ${{ github.actor }}
@@ -38,15 +38,15 @@ jobs:
     name: Validate sources job
     needs: [plan]
     if: ${{ needs.plan.outputs.publish == 'true' }}
-    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@a33d7d77ffa7f6af52cddce01f7250be282546ed # 2.0.483
+    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@32582848ffb0505e1044e5552b5ed94c32500c57 # 2.0.518
     permissions:
       contents: read
 
   publish:
     name: Publish project release job
     needs: [plan, validate]
     if: ${{ needs.plan.outputs.publish == 'true' && needs.validate.result == 'success' }}
-    uses: ptr727/ProjectTemplate/.github/workflows/build-release-task.yml@a33d7d77ffa7f6af52cddce01f7250be282546ed # 2.0.483
+    uses: ptr727/ProjectTemplate/.github/workflows/build-release-task.yml@32582848ffb0505e1044e5552b5ed94c32500c57 # 2.0.518
     permissions:
       contents: write
       actions: write

.github/workflows/test-pull-request.yml

@@ -32,7 +32,7 @@ jobs:
 
   validate:
     name: Validate sources job
-    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@a33d7d77ffa7f6af52cddce01f7250be282546ed # 2.0.483
+    uses: ptr727/ProjectTemplate/.github/workflows/validate-task.yml@32582848ffb0505e1044e5552b5ed94c32500c57 # 2.0.518
     permissions:
       contents: read
 

OPERATIONS.md

@@ -478,7 +478,7 @@ The steps below run ESPHome outside the live instance, on a workstation, which i
 Sharp edges in the tooling around this repository, each one learned by tripping over it.
 
 - **Never build a GitHub comment or reply body inside a double-quoted shell string.** Write it to a file and pass `--body-file`, or `-F body=@file` on a REST call. Backticks in a double-quoted string are command substitution, so a body that mentions a path in code formatting **executes that path**. This is not theoretical: a review reply naming the ruleset apply script in code formatting **executed** it, back when this repository carried its own copy, and that script writes by default, so the posted comment came out with its code spans replaced by command output. Escaping each backtick works and is one missed backslash from repeating the incident. The hazard is the shell's, not that script's, so it survives the copy being retired.
-- **The ruleset apply script writes unless told otherwise, and it is hub-hosted rather than carried here.** Run it from a hub checkout and name this repository explicitly, since it otherwise targets whichever repository the shell is sitting in. Its default mode PATCHes repository settings, toggles Dependabot features, and PUTs both branch rulesets. Pass its `check` mode for read-only validation, which is what you almost always want. The payloads it compares against are the hub's own committed `repo-config/` files; this repository carries no local copy, per [AUDIT.md "General Settings and Rulesets"][audit-general-settings-and-rulesets].
+- **The ruleset apply script writes unless told otherwise, and it is hub-hosted rather than carried here.** Run it from a hub checkout and name this repository explicitly, since it otherwise targets whichever repository the shell is sitting in. Its default mode PATCHes repository settings, toggles Dependabot features, and PUTs both branch rulesets. Pass its `check` mode for read-only validation, which is what you almost always want. The payloads it compares against are the hub's own committed `repo-config/` files. This repository carries no local copy, per [AUDIT.md "General Settings and Rulesets"][audit-general-settings-and-rulesets].
 - **This file uses reference-style links, and it is the one file in this repository that should not.** The fleet rule allows four agent-instruction files to keep inline links, [`AGENTS.md`][agents], [`GOVERNANCE.md`][governance], this one, and `.github/copilot-instructions.md`, on the grounds that they are read one section at a time so a definition at the foot of the file is never reached. The other three take that allowance and this one does not, which is a divergence to close deliberately rather than incidentally. Every other Markdown file in the repository is reference-style by the rule rather than by exception. Definitions live at the bottom of the file, grouped under `<!-- Repo -->` and `<!-- External -->` and alphabetized within each group. A reference name encodes what it points at, so `analog-max17048-link`, never `analog-en-products-link` after a URL path segment. Removing a link also removes its definition, since an orphan fails the lint.
 - **Inline HTML is limited to `<details>` and `<summary>`.** Those two are allowed because a collapsible has no markdown equivalent. Every other element still fails `MD033`, and that includes a `<code>` nested inside a `<summary>` - use a markdown code span there instead.
 - **The spell-check gate covers `**/README.md` plus [`DEVICES.md`][devices] and `HISTORY.md`**, wider than the fleet default, so a nested README fails CI like any other. The CI workflow and the `Lint: Spelling` task carry the identical list.